Ghidra

Ghidra is the National Security Agency’s flagship software reverse engineering framework, publicly released in March 2019 at the RSA Conference. With over 64,300 GitHub stars, it has rapidly become one of the most popular reverse engineering tools worldwide. The framework offers enterprise-grade capabilities completely free and open source under the Apache License 2.0.

The NSA developed Ghidra over decades for internal use before making it available to the public. This government pedigree shows in its sophisticated analysis algorithms, comprehensive architecture support, and robust collaborative features. Version 11.3, released in 2025, introduced kernel-level debugging, JIT p-code emulation, Visual Studio Code integration, and enhanced function graph layouts.

What is Ghidra?

Ghidra is a software reverse engineering suite that disassembles and decompiles compiled binaries into human-readable representations. The tool supports analyzing executables across platforms including Windows, macOS, Linux, Android, iOS, and embedded systems. Its multi-architecture support covers x86, x86-64, ARM, ARM64, MIPS, PowerPC, and dozens of other processor families.

The framework’s decompiler converts assembly code into C-like pseudocode that is often remarkably readable and accurate. This decompilation capability accelerates reverse engineering tasks that would take significantly longer working with raw assembly. The intermediate representation (p-code) enables sophisticated analysis and cross-architecture code understanding.

Ghidra’s collaborative features allow multiple analysts to work on the same project simultaneously, sharing annotations, function names, and analysis results in real-time. This makes it invaluable for team-based security research and large-scale reverse engineering projects.

Key features

Disassembly and Decompilation

Ghidra’s disassembler produces accurate assembly listings with automatic function identification, call graph construction, and cross-reference generation. The auto-analysis phase applies hundreds of analyzers to identify code patterns, resolve indirect calls, and reconstruct high-level structures.

The decompiler output quality rivals commercial alternatives, producing C pseudocode that often compiles or serves as the basis for vulnerability research. Variable type inference, structure recovery, and control flow reconstruction make complex binaries understandable.

Mobile Binary Analysis

For mobile security testing, Ghidra is essential for analyzing native code components. Android apps often include native libraries (.so files) for performance-critical operations or to protect sensitive logic. Jadx handles the Java/Kotlin code, while Ghidra reverse engineers these compiled libraries.

On iOS, all app code is compiled to native ARM64 binaries. Ghidra can load Mach-O executables directly, enabling comprehensive analysis of iOS apps without jailbreak. Combined with Frida for runtime instrumentation, you can validate your static analysis findings dynamically.

Debugging and Dynamic Analysis

Ghidra 11.3 introduced a powerful integrated debugger that connects to GDB, LLDB, and WinDbg. This allows you to step through code execution, set breakpoints, examine memory, and observe runtime behavior without leaving the Ghidra interface. The unified view of static and dynamic analysis accelerates understanding.

For mobile testing, you can debug Android native libraries using GDB on a rooted device, or debug iOS binaries via LLDB on a jailbroken device. The debugger synchronizes with your static analysis annotations, providing context as you trace execution.

Scripting and Automation

Ghidra’s scripting capabilities enable automation of repetitive analysis tasks. The Python and Java APIs provide programmatic access to virtually all framework functionality. You can write scripts to find specific code patterns, extract cryptographic constants, or generate custom reports.

The plugin architecture allows extending Ghidra with completely new analysis capabilities. Community plugins add features like binary diffing enhancements, custom decompiler outputs, and integrations with other security tools.

Collaborative Reverse Engineering

Ghidra Server enables teams to share projects in a central repository with version control. Multiple analysts can work on different parts of a binary simultaneously, with changes synchronized in real-time. This collaborative approach is particularly valuable for large mobile apps or complex malware analysis.

When to use Ghidra

Strengths:

• Completely free and open source with no licensing costs
• Government-grade capabilities and active NSA development
• Excellent decompilation quality for modern binaries
• Comprehensive architecture support including mobile processors
• Collaborative features unmatched by commercial alternatives
• Extensible via Python/Java scripting and plugins
• Strong community with extensive documentation and tutorials
• Cross-platform (runs on Windows, macOS, Linux)

Limitations:

• Steeper learning curve than specialized mobile-only tools
• GUI can be overwhelming for beginners with many panels and options
• Large binaries may require significant RAM and processing time
• Some third-party plugins are less mature than IDA Pro equivalents
• Auto-analysis can take time on complex executables

Getting started

Combine Ghidra with Hopper for macOS/iOS-specific analysis, Jadx for decompiling Android apps, and Objection for rapid mobile pentesting.

Frequently Asked Questions